S. 4946: Health and Location Data Protection Act of 2026

This bill would make it illegal for data brokers to buy, sell, share, license, trade, or otherwise provide certain sensitive personal data related to people’s location or health.

What data would be covered

The bill covers two main kinds of data:

• Location data: information that can identify where a person or their device has been in the past or is now.
• Health data: information that shows or suggests a person’s health status, including disabilities, physical or mental health conditions, pregnancy, miscarriage, treatment, diagnosis, or searches and prompts about health services or supplies, including when entered into an AI system.

The FTC would also be allowed to define additional data types that reveal or point to location or health information.

Who would be covered

The bill defines a data broker as an entity that, for payment or other value, sells or otherwise shares data it did not collect directly from the individual. The definition includes many companies that trade in data, but it excludes some organizations and activities, such as:

• transmitting data at the request of the individual;
• providing a product or service where sensitive data is not the product itself;
• news reporting and other public-interest journalism;
• making publicly available information available, such as from books, media, or public websites.

Exceptions

The bill would not stop:

• HIPAA-compliant handling of health information by covered entities and business associates;
• publication of newsworthy information of legitimate public concern;
• sharing data when a person gives valid authorization under FTC-adopted rules.

How it would be enforced

The bill would treat violations as unfair or deceptive practices under FTC law. The FTC could enforce the law using its normal powers, and it could also go to federal court to:

• stop ongoing violations;
• require compliance, including deletion of relevant data;
• seek injunctions, civil penalties, damages, restitution, disgorgement, and other relief.

State attorneys general could also sue under the law, and private individuals could bring civil lawsuits as well.

Penalties and court rules

A violation could lead to a civil penalty of up to 15% of the revenues earned by the violator’s ultimate parent company during the previous 12 months.

The bill sets special court rules for where lawsuits can be filed and gives the D.C. Circuit exclusive jurisdiction over appeals.

Rulemaking and timing

The FTC would have to issue final rules within 180 days after enactment. The main prohibition would take effect on the earlier of:

• the date the FTC’s final rule is issued, or
• 180 days after enactment.

Relationship to state law

The bill would preempt only state or local laws that require disclosure that this bill forbids. Other state privacy laws would generally remain in place.

Funding

The bill would provide $1 billion to the FTC for fiscal year 2027, available through September 30, 2035, to carry out the law.

Relevant Companies

• ACXI - Acxiom participates in data brokerage and marketing data services, so limits on selling or transferring location and health data could directly affect parts of its business.
• EXPGY - Experian has data-related products and matching services; if any of its operations involve brokered consumer data, this law could restrict those activities.
• CRTO - Criteo is involved in digital advertising and audience data use; restrictions on sensitive location or health data could affect ad targeting and data-sharing practices.
• FICO - FICO operates in consumer data analytics and decisioning; if sensitive data brokerage is part of any related services, compliance costs or product changes could be required.